cti-pattern-validator icon indicating copy to clipboard operation
cti-pattern-validator copied to clipboard

Validate ANDed expressions match the same SCO

Open clenk opened this issue 4 years ago • 0 comments

[file:name = 'foo' AND domain-name:value = 'example.com'] passes validation but should not. All Comparison Expressions connected by AND must match against the same SCO, which by definition means they must be of the same object type (file != domain-name).

It would be legal if they were connected by OR instead: [file:name = 'foo' OR domain-name:value = 'example.com']

clenk avatar Feb 01 '21 20:02 clenk